3 ms·
It's a good idea if you encrypt with the same key _once_ — you can avoid attaching nonces to your ciphertext (less code and data), and have only 16-byte key in
by dchest 7y ago
It's a good idea if you encrypt with the same key _once_ — you can avoid attaching nonces to your ciphertext (less code and data), and have only 16-byte key in the URL.
In fact, using a random IV with AES-GCM is not exactly safe: 12-byte nonce is too small to avoid collisions with many encryptions. The recommendation is to not encrypt more than 2^32 messages with the same key if you use the random nonce.
- vbezhenar 7y agoWhat would happen if an attacker gets two different messages with identical IV and key?
- dchest 7y agoThey'll get the XOR of the two original messages, and also can break authentication: https://crypto.stackexchange.com/questions/26790/how-bad-it-is-using-the-same-iv-twice-with-aes-gcm/68525#68525 https://crypto.stackexchange.com/questions/26790/how-bad-it-...
- vbezhenar 7y agoThat's scary, thanks!